百度网盘高清视频在线观看:
链接: https://pan.baidu.com/s/1o-ID7Oo1a30Zlvqnl8Gcwg
?pwd=o7js 提取码: o7jsJS解密的特点就是见eval就去掉, 除非用了更特别的手段
本例中去eval并执行得到
var _$=["",'','\\\x77\x2b','\\\x62','\\\x62','\x67','\x65\x20\x34\x24\x3d\x5b\x22\\\x37\\\x38\\\x33\\\x39\\\x33\\\x36\\\x35\\\x32\\\x32\\\x31\\\x64\\\x32\\\x66\\\x31\\\x31\x22\x5d\x3b\x61\x20\x62\x28\x29\x7b\x63\x3d\x20\x34\x24\x5b\x30\x5d\x7d','\x7c\x78\x36\x34\x7c\x78\x32\x66\x7c\x78\x36\x39\x7c\x5f\x7c\x78\x33\x61\x7c\x78\x36\x65\x7c\x78\x37\x37\x7c\x78\x36\x35\x7c\x78\x37\x38\x7c\x66\x75\x6e\x63\x74\x69\x6f\x6e\x7c\x6f\x6e\x65\x6b\x65\x79\x7c\x6c\x6f\x63\x61\x74\x69\x6f\x6e\x7c\x78\x36\x63\x7c\x76\x61\x72\x7c\x78\x36\x31','\x7c']window["\x65\x76\x61\x6c"](function(O2b,a5f,O1e,O27,e,O7f){e=function(O25){return(O25<a5f? _$[0]:e(window["\x70\x61\x72\x73\x65\x49\x6e\x74"](O25/a5f)))+((O25=O25%a5f)>0x23?String["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](O25+0x1d):O25["\x74\x6f\x53\x74\x72\x69\x6e\x67"](0x24))}if(! _$[1]["\x72\x65\x70\x6c\x61\x63\x65"](/^/,String)){while(O1e--)O7f[e(O1e)]=O27[O1e]||e(O1e)O27=[function(a42){return O7f[a42]}]e=function(){return _$[2]}O1e=0x1}while(O1e--)if(O27[O1e])O2b=O2b["\x72\x65\x70\x6c\x61\x63\x65"](new RegExp( _$[3]+e(O1e)+ _$[4], _$[5]),O27[O1e])return O2b}( _$[6],0x10,0x10, _$[7]["\x73\x70\x6c\x69\x74"]( _$[8]),0x0,{}))显然是又一道加密
观察到window["\x65\x76\x61\x6c"]
就是window.eval
去掉它执行得到
var _$=["\x77\x65\x69\x78\x69\x6e\x3a\x2f\x2f\x64\x6c\x2f\x61\x64\x64"]function onekey(){location= _$[0]}
格式化後得到
var _$=["weixin://dl/add"]
function onekey(){location=_$[0]}